@pasko70/pibo 2.5.1 → 2.5.2

package/dist/agent-runtimes/codex-native/adapter.js

@@ -733,6 +733,7 @@ export class CodexNativeAgentRuntimeAdapter {
             resources: input.services?.resources,
             nativeSubagentsEnabled: input.profile.nativeSubagents,
         };
+        const profileOptions = parseCodexNativeProfileOptions(input.profile.runtimeOptions);
         const startProcessBundle = async (processGeneration) => {
             let delivery;
             let ownedProcess;
@@ -745,6 +746,7 @@ export class CodexNativeAgentRuntimeAdapter {
                     sessionGeneration: processGeneration,
                     workspace: input.workspace,
                     clientVersion: CODEX_NATIVE_ADAPTER_VERSION,
+                    experimentalApi: profileOptions.permissionMode === "plan",
                     resourceEnvironment: delivery.environment,
                 });
                 await delivery.configureProcess(ownedProcess.client, input.workspace);
@@ -765,7 +767,6 @@ export class CodexNativeAgentRuntimeAdapter {
             process = initial.process;
             const compatibility = input.services?.compatibility;
             const catalog = await this.loadModelCatalog(process.client);
-            const profileOptions = parseCodexNativeProfileOptions(input.profile.runtimeOptions);
             const persisted = binding.state === "bound"
                 ? readCodexNativePersistedSettings(binding.metadata)
                 : { profileOptions: {} };
@@ -790,6 +791,7 @@ export class CodexNativeAgentRuntimeAdapter {
                     reasoningSummary: Object.hasOwn(persistedOptions, "reasoningSummary")
                         ? persistedOptions.reasoningSummary
                         : profileOptions.reasoningSummary,
+                    permissionMode: profileOptions.permissionMode,
                 },
             });
             const threadSelection = {

package/dist/agent-runtimes/codex-native/models.js

@@ -19,6 +19,13 @@ export const CODEX_NATIVE_MODEL_OPTIONS_SCHEMA = {
             enum: ["auto", "concise", "detailed", "none"],
             description: "Optional native Codex reasoning-summary mode.",
         },
+        permissionMode: {
+            type: "string",
+            title: "Permission mode",
+            enum: ["approval", "yolo", "plan"],
+            default: "approval",
+            description: "Codex permissions: Approval asks before privileged work, YOLO disables approvals with unrestricted host access, and Plan uses a read-only planning turn.",
+        },
     },
 };
 const MAX_MODEL_PAGES = 20;
@@ -34,6 +41,7 @@ const MAX_DESCRIPTION_LENGTH = 4_096;
 const MAX_CURSOR_LENGTH = 1_024;
 const PERSONALITIES = new Set(["none", "friendly", "pragmatic"]);
 const REASONING_SUMMARIES = new Set(["auto", "concise", "detailed", "none"]);
+const PERMISSION_MODES = new Set(["approval", "yolo", "plan"]);
 const BINDING_MODEL_KEY = "codexNativeModelId";
 const BINDING_REASONING_KEY = "codexNativeReasoningEffort";
 const BINDING_SERVICE_TIER_KEY = "codexNativeServiceTier";
@@ -271,7 +279,7 @@ export function readCodexNativePersistedSettings(metadata) {
     };
 }
 export function parseCodexNativeProfileOptions(value) {
-    const allowed = new Set(["serviceTier", "personality", "reasoningSummary"]);
+    const allowed = new Set(["serviceTier", "personality", "reasoningSummary", "permissionMode"]);
     const unknown = Object.keys(value).filter((key) => !allowed.has(key));
     if (unknown.length > 0)
         throw new Error(`Unsupported native Codex runtime option${unknown.length === 1 ? "" : "s"}: ${unknown.join(", ")}.`);
@@ -297,8 +305,43 @@ export function parseCodexNativeProfileOptions(value) {
         }
         options.reasoningSummary = value.reasoningSummary;
     }
+    if (Object.hasOwn(value, "permissionMode")) {
+        if (typeof value.permissionMode !== "string" || !PERMISSION_MODES.has(value.permissionMode)) {
+            throw new Error("Native Codex runtime option permissionMode must be one of: approval, yolo, plan.");
+        }
+        options.permissionMode = value.permissionMode;
+    }
     return options;
 }
+export function codexNativePermissionMode(options) {
+    return options.permissionMode ?? "approval";
+}
+export function codexNativeThreadPermissionSelection(mode) {
+    if (mode === "yolo")
+        return { approvalPolicy: "never", sandbox: "danger-full-access" };
+    if (mode === "plan")
+        return { approvalPolicy: "on-request", sandbox: "read-only" };
+    return { approvalPolicy: "on-request", sandbox: "workspace-write" };
+}
+export function codexNativeTurnPermissionOptions(mode, model, effort) {
+    if (mode === "yolo") {
+        return { approvalPolicy: "never", sandboxPolicy: { type: "dangerFullAccess" } };
+    }
+    if (mode === "plan") {
+        return {
+            approvalPolicy: "on-request",
+            sandboxPolicy: { type: "readOnly", networkAccess: false },
+            collaborationMode: {
+                mode: "plan",
+                settings: { model, reasoning_effort: effort, developer_instructions: null },
+            },
+        };
+    }
+    return {
+        approvalPolicy: "on-request",
+        sandboxPolicy: { type: "workspaceWrite", networkAccess: false },
+    };
+}
 function findModel(catalog, value) {
     return catalog.models.find((model) => model.id === value || model.model === value);
 }
@@ -374,6 +417,7 @@ export class CodexNativeSessionSettingsController {
     serviceTier;
     personality;
     reasoningSummary;
+    permissionMode;
     activeThreadId;
     contextUsage;
     pendingContextUsage = new Map();
@@ -394,6 +438,7 @@ export class CodexNativeSessionSettingsController {
         this.serviceTier = validateServiceTier(this.currentModel, selectedTier);
         this.personality = initial.profileOptions.personality;
         this.reasoningSummary = initial.profileOptions.reasoningSummary;
+        this.permissionMode = codexNativePermissionMode(initial.profileOptions);
         this.bindClient(client);
     }
     bindClient(client) {
@@ -459,6 +504,7 @@ export class CodexNativeSessionSettingsController {
             model: this.currentModel.id,
             serviceTier: this.serviceTier,
             ...(this.personality !== undefined ? { personality: this.personality } : {}),
+            ...codexNativeThreadPermissionSelection(this.permissionMode),
         };
     }
     get turnOptions() {
@@ -468,6 +514,7 @@ export class CodexNativeSessionSettingsController {
             serviceTier: this.serviceTier,
             ...(this.reasoningSummary !== undefined ? { summary: this.reasoningSummary } : {}),
             ...(this.personality !== undefined ? { personality: this.personality } : {}),
+            ...codexNativeTurnPermissionOptions(this.permissionMode, this.currentModel.id, this.reasoningLevel),
         };
     }
     setModel(model) {

package/dist/agent-runtimes/codex-native/process.js

@@ -422,7 +422,7 @@ export async function startCodexNativeAppServer(input) {
     const paths = await prepareCodexNativeSessionPaths(input);
     let client;
     try {
-        const capabilities = { experimentalApi: false };
+        const capabilities = { experimentalApi: input.experimentalApi === true };
         const invocation = codexExecutableInvocation(input.config.executable, [
             "app-server",
             "--stdio",

package/dist/agent-runtimes/codex-native/thread.js

@@ -214,13 +214,13 @@ export class CodexNativeThreadController {
     client;
     currentThread;
     currentConfiguration;
-    resourceSelection;
+    inheritedSelection;
     knownThreads = new Map();
-    constructor(client, currentThread, currentConfiguration, resourceSelection) {
+    constructor(client, currentThread, currentConfiguration, inheritedSelection) {
         this.client = client;
         this.currentThread = currentThread;
         this.currentConfiguration = currentConfiguration;
-        this.resourceSelection = resourceSelection;
+        this.inheritedSelection = inheritedSelection;
         this.knownThreads.set(currentThread.id, structuredClone(currentThread));
     }
     static async start(client, workspace, selection = {}) {
@@ -230,11 +230,15 @@ export class CodexNativeThreadController {
             ...(selection.model ? { model: selection.model } : {}),
             ...(selection.serviceTier !== undefined ? { serviceTier: selection.serviceTier } : {}),
             ...(selection.personality !== undefined ? { personality: selection.personality } : {}),
+            ...(selection.approvalPolicy ? { approvalPolicy: selection.approvalPolicy } : {}),
+            ...(selection.sandbox ? { sandbox: selection.sandbox } : {}),
             ...(selection.config ? { config: selection.config } : {}),
             ...(selection.developerInstructions ? { developerInstructions: selection.developerInstructions } : {}),
         });
         const selected = threadSessionFromResponse(response, "thread/start");
         return new CodexNativeThreadController(client, selected.thread, selected.configuration, {
+            ...(selection.approvalPolicy ? { approvalPolicy: selection.approvalPolicy } : {}),
+            ...(selection.sandbox ? { sandbox: selection.sandbox } : {}),
             ...(selection.config ? { config: structuredClone(selection.config) } : {}),
             ...(selection.developerInstructions ? { developerInstructions: selection.developerInstructions } : {}),
         });
@@ -247,6 +251,8 @@ export class CodexNativeThreadController {
                 ...(selection.model ? { model: selection.model } : {}),
                 ...(selection.serviceTier !== undefined ? { serviceTier: selection.serviceTier } : {}),
                 ...(selection.personality !== undefined ? { personality: selection.personality } : {}),
+                ...(selection.approvalPolicy ? { approvalPolicy: selection.approvalPolicy } : {}),
+                ...(selection.sandbox ? { sandbox: selection.sandbox } : {}),
                 ...(selection.config ? { config: selection.config } : {}),
                 ...(selection.developerInstructions ? { developerInstructions: selection.developerInstructions } : {}),
             });
@@ -255,6 +261,8 @@ export class CodexNativeThreadController {
             if (thread.id !== threadId)
                 throw new CodexNativeThreadProtocolError("Codex resumed a different thread than requested.");
             return new CodexNativeThreadController(client, thread, selected.configuration, {
+                ...(selection.approvalPolicy ? { approvalPolicy: selection.approvalPolicy } : {}),
+                ...(selection.sandbox ? { sandbox: selection.sandbox } : {}),
                 ...(selection.config ? { config: structuredClone(selection.config) } : {}),
                 ...(selection.developerInstructions ? { developerInstructions: selection.developerInstructions } : {}),
             });
@@ -353,9 +361,11 @@ export class CodexNativeThreadController {
             ...(lastTurnId ? { lastTurnId } : {}),
             cwd: workspace,
             ephemeral: false,
-            ...(this.resourceSelection.config ? { config: structuredClone(this.resourceSelection.config) } : {}),
-            ...(this.resourceSelection.developerInstructions
-                ? { developerInstructions: this.resourceSelection.developerInstructions }
+            ...(this.inheritedSelection.approvalPolicy ? { approvalPolicy: this.inheritedSelection.approvalPolicy } : {}),
+            ...(this.inheritedSelection.sandbox ? { sandbox: this.inheritedSelection.sandbox } : {}),
+            ...(this.inheritedSelection.config ? { config: structuredClone(this.inheritedSelection.config) } : {}),
+            ...(this.inheritedSelection.developerInstructions
+                ? { developerInstructions: this.inheritedSelection.developerInstructions }
                 : {}),
         };
         try {

package/dist/agent-runtimes/codex-native/turn.js

@@ -291,6 +291,9 @@ export class CodexNativeTurnController {
             model: modelOptions.model,
             effort: modelOptions.effort,
             serviceTier: modelOptions.serviceTier,
+            approvalPolicy: modelOptions.approvalPolicy,
+            sandboxPolicy: modelOptions.sandboxPolicy,
+            ...(modelOptions.collaborationMode ? { collaborationMode: modelOptions.collaborationMode } : {}),
             ...(modelOptions.summary !== undefined ? { summary: modelOptions.summary } : {}),
             ...(modelOptions.personality !== undefined ? { personality: modelOptions.personality } : {}),
         };

package/dist/apps/chat/agent-store.js

@@ -793,6 +793,9 @@ function sanitizeSubagents(value) {
         const thinkingLevel = sanitizeThinkingLevel(candidate.thinkingLevel);
         if (thinkingLevel)
             subagent.thinkingLevel = thinkingLevel;
+        if (candidate.runtimeOptions && typeof candidate.runtimeOptions === "object" && !Array.isArray(candidate.runtimeOptions)) {
+            subagent.runtimeOptions = structuredClone(candidate.runtimeOptions);
+        }
         if (typeof candidate.timeoutMs === "number")
             subagent.timeoutMs = candidate.timeoutMs;
         if (typeof candidate.maxDepth === "number")

package/dist/apps/chat/chat-request-normalizers.js

@@ -407,6 +407,12 @@ export function normalizeAgentSubagents(value) {
         const thinkingLevel = normalizeThinkingLevel(raw.thinkingLevel, "subagent thinkingLevel");
         if (thinkingLevel)
             subagent.thinkingLevel = thinkingLevel;
+        if (raw.runtimeOptions !== undefined) {
+            if (!raw.runtimeOptions || typeof raw.runtimeOptions !== "object" || Array.isArray(raw.runtimeOptions)) {
+                throw new PiboWebHttpError("subagent runtimeOptions must be a JSON object", 400);
+            }
+            subagent.runtimeOptions = normalizeAgentRuntimeJsonObject(raw.runtimeOptions, "subagent runtimeOptions", 0);
+        }
         if (raw.timeoutMs !== undefined) {
             if (typeof raw.timeoutMs !== "number" || !Number.isFinite(raw.timeoutMs) || raw.timeoutMs <= 0) {
                 throw new PiboWebHttpError("subagent timeoutMs must be a positive number", 400);